feat: Add audit system with sink based dispatcher (#211)

* chore: Dependency update

* feat: Add audit system with eventlog as a sink

* fix: Linter fixes

* fix: Code review fixes

analyzer/analyzer.go

@@ -35,6 +35,12 @@ type PackageVersionAnalysisResult struct {
 	// Summary of the analysis
 	Summary string
 
+	// Whether the package is flagged as malware by inference
+	IsMalware bool
+
+	// Whether the malware verdict has been verified (confirmed by a human or verification system)
+	IsVerified bool
+
 	// Analyzer specific data
 	Data any
 }

analyzer/malysis_query.go

@@ -66,6 +66,7 @@ func (a *malysisQueryAnalyzer) Analyze(ctx context.Context,
 	cfg := config.Get()
 	// Mark the package version to be confirmed if it is malicious (not confirmed)
 	if res.GetReport().GetInference().GetIsMalware() {
+		analysisResult.IsMalware = true
 		analysisResult.Action = ActionConfirm
 
 		// Treat suspicious package as malicious when `--paranoid` flag is set to true
@@ -76,6 +77,8 @@ func (a *malysisQueryAnalyzer) Analyze(ctx context.Context,
 
 	// This is a confirmed malicious package, we must always block it
 	if res.GetVerificationRecord().GetIsMalware() {
+		analysisResult.IsMalware = true
+		analysisResult.IsVerified = true
 		analysisResult.Action = ActionBlock
 	}
 

analyzer/malysis_query_test.go

@@ -164,6 +164,11 @@ func (s *stubMalwareAnalysisServiceClient) InternalAnalyzePackage(ctx context.Co
 	return nil, nil
 }
 func (s *stubMalwareAnalysisServiceClient) ListPackageAnalysisRecords(ctx context.Context, req *malysisv1.ListPackageAnalysisRecordsRequest, opts ...grpc.CallOption) (*malysisv1.ListPackageAnalysisRecordsResponse, error) {
-	// Not used in these tests
+	return nil, nil
+}
+func (s *stubMalwareAnalysisServiceClient) InternalAgenticAnalyzePackage(ctx context.Context, req *malysisv1.InternalAgenticAnalyzePackageRequest, opts ...grpc.CallOption) (*malysisv1.InternalAgenticAnalyzePackageResponse, error) {
+	return nil, nil
+}
+func (s *stubMalwareAnalysisServiceClient) InternalPublishDomainEvent(ctx context.Context, req *malysisv1.InternalPublishDomainEventRequest, opts ...grpc.CallOption) (*malysisv1.InternalPublishDomainEventResponse, error) {
 	return nil, nil
 }